Lol yeah that's how I usually check md5 hashes too. But that doesn't work: this is from /dev/urandom while filtering out only /[ -~]/. It seems people don't like that I'm proving the point by a super simple example though. And yes, my passwords are as strong as this, I don't use text passwords. Cracking 40 character passwords is absolute bullshit.

Misinterpretation, not bullshit. Per another reply, the original document was about 40 characters of English text.

> Misinterpretation, not bullshit.

Fair enough. I'm still curious about the generation method though: I can imagine that testing all texts ever published takes $200k if you go up to 40 characters, but if you use a unique text it might be different. There are a lot of variables here, including honest misspellings, punctuation use, spacing (non-tech people seem to find spaces weird in passwords), capitalization, usage of names, etc.

Maybe if we start changing the label to "Passwords" or "Pass phrase" to indicate that you can do something more expressive.

It bugs me that even today, more systems (hello banks) don't support more open passwords. Even what's on a US Ascii keyboard would be nice. Two of my banks only support letters and numbers, no special characters and case insensitive.

Your passwords are as strong as the protection of the place where you store them.

I think > Your passwords are as most as strong as the protection of the place where you store them.

would be more appropriate

Brainz.

I think while typing them in is when they are most susceptible to being stolen.